Part of Leviathan Platform · standalone license available
Trust the tool, pin the schema. Safe STDIO launch, admission scanning, argument scanning, lifecycle sequencing, and drift pinning for Model Context Protocol tool calls — zero pip dependencies, real tests, honest about its limits.
What it actually catches
Each one is a genuine attack surface a naive integration leaves open — not a hypothetical.
Anthropic's own official SDKs (Python, TypeScript, Java, Rust) pass configured command strings straight to a shell — unconditionally, even when the target binary doesn't exist. A real, disclosed flaw (OX Security, April 2026: 200,000+ vulnerable deployments, 14 CVEs) that Anthropic declined to fix at the protocol level, calling it "expected." This isn't academic: the same broader pattern — unauthenticated RCE in agent-adjacent infrastructure — is what CVE-2025-3248 (an unauthenticated Langflow RCE on CISA's Known Exploited Vulnerabilities list, a different specific flaw, same category of exposure) gave JadePuffer, the first documented case of fully autonomous, agentic ransomware, running an entire extortion operation end to end with no human operator. Safe STDIO launch closes it: list-form argv, shell=False, executable resolved via shutil.which() before anything runs.
Every MCP tool description is scanned for injection at admission time — before it's added to an agent's available toolset, not after something goes wrong. This is a real, demonstrated technique, not a hypothetical: Invariant Labs planted an instruction inside an innocuous simple_calculator tool's own description telling the model to also read ~/.ssh/id_rsa and smuggle it out through a hidden parameter on that same, otherwise-ordinary call — the tool's real function worked exactly as expected, which is what made it easy to miss.
Every call's arguments are scanned for "value becomes code" shapes — dunder-chain attribute gadgets, eval/exec-shaped literals, pickle headers, and unsafe YAML tags — before they reach the tool. That last category is the exact vulnerability class behind CVE-2026-76404 (CVSS 9.1, disclosed August 2026): an insecure-deserialization RCE in the Splunk MCP Server app's credential-management component, the first critical vulnerability found in a vendor-backed, enterprise-grade MCP server. Said plainly: this scans for that class of shape in tool-call arguments, not that specific code path in Splunk's own credential storage — a smell detector flagging a review-worthy shape, not proof of exploitability.
Every admitted tool's description is hashed and pinned. A re-admission from the same server with a changed description is flagged for review — a real "rug pull" attack class, not auto-trusted.
Six modules
McpLifecycleGuard sequences the core admission/call/result flow into one admit → before_call → after_call guard, instead of requiring you to remember to call several functions correctly, every time.
shell=True, executable resolved before launchregister_custom_pattern() — no support ticket, no waiting on us.tripped()Pricing
Flat. Unlimited environments and seats within your org. Covers the library, the CLI, and updates for the year.